test to ensure session_controller returns auth block